# Howgrave-Graham lattice attack on NTRU

I am lookin for a good example to illustrate this attack on NTRU using low parameters but I failed to do that, The attack consist to use LLL reduction on A basis of NTRU Lattice, let us use the column convention, how Can I use the first vector to retrieve (f,g)???

• Isn't h, the public-key in NTRU? I think you're asking about (f,g) which belongs to R^2. Jun 3 '21 at 7:03
• yeah thanks Mr @AaqibBashir Jun 3 '21 at 10:53
• The column has $2N$ entries, so it is really a vector $(f', g') \in R^2$ (the first $N$ entries correspond to the $N$ coefficients of $f'$...). If your reduction is successful, then this column is short and the polynomial $f'$ that you get is the secret $f$ or a small multiple of $f$, which is usually already enough to decrypt the ciphertexts. Jun 3 '21 at 11:08